Cyber Posture

CVE-2025-25068

High

Published: 21 March 2025

Published
21 March 2025
Modified
27 March 2025
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0007 20.7th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.

Security Summary

CVE-2025-25068 is a vulnerability in Mattermost versions 10.4.x up to and including 10.4.2, 10.3.x up to and including 10.3.3, 9.11.x up to and including 9.11.8, and 10.5.x up to and including 10.5.0. It stems from a failure to enforce multi-factor authentication (MFA) on plugin endpoints, allowing authenticated attackers to bypass MFA protections through API requests to plugin-specific routes. The issue is mapped to CWE-306 (Missing Authentication for Critical Function) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Attackers require low-privilege authenticated access (PR:L) and network connectivity (AV:N) to exploit this vulnerability, which demands high attack complexity (AC:H) but no user interaction (UI:N). Exploitation enables bypassing MFA restrictions, potentially leading to high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) by accessing protected plugin functionalities without additional authentication.

Mattermost has published details on this vulnerability in their security updates, available at https://mattermost.com/security-updates, which security practitioners should consult for patch information and mitigation guidance.

Details

CWE(s)
CWE-306

Affected Products

mattermost
mattermost server
9.11.0 — 9.11.9 · 10.3.0 — 10.3.4 · 10.4.0 — 10.4.3

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1556.006 Multi-Factor Authentication Defense Impairment
Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.
Why these techniques?

Vulnerability in public-facing Mattermost app allows remote authenticated access to bypass MFA enforcement on plugin API endpoints (CWE-306), directly mapping to exploitation of public-facing application and MFA bypass technique.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References